Questions tagged [auditdistd]

Questions related to the audit trail file distribution daemon developed under the sponsorship of FreeBSD Foundation. Its Linux Audit counterparts are `audispd` and `audisp-remote`.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

auditd not showing certain record events type

I have recently install auditd and play around with it. And i found on ubuntu 18 the auditd log will show record entry like this audit[23183]: USER_CMD pid=23183 uid=1000 auid=1000 ses=517 msg='cwd=&...
user avatar
1 vote
1 answer
2k views

FreeBSD: How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified?

How do you use auditd for logging when files and folders are opened, read, moved, deleted or modified? Looking at the information here, i don't see how to accomplish the task. I'm trying to get a ...
user avatar
  • 303
2 votes
2 answers
126 views

What does undocumented "proto" command line argument do in auditdistd on FreeBSD?

As you might know there is an auditdistd(8) daemon available on FreeBSD. It has some documented command line arguments like -c, -d, etc. (see more here (link)). I was trying to learn how it works ...
user avatar